[Contents] [Prev] [Next] [Index] [Report an Error]

Option: Configuring Port Mirroring with Filter-Based Forwarding and a Monitoring Group

For active flow monitoring, you can load-balance traffic across multiple Monitoring Services PICs using the same method as passive flow monitoring. The only difference is that you do not configure the input interface with the passive-monitor-mode statement at the [edit interfaces interface-name] hierarchy level.

To load-balance traffic for active flow monitoring, port-mirror the incoming packets to a tunnel services interface. Redirect this copy of the traffic to a filter-based forwarding instance by applying a firewall filter to the tunnel services interface. Configure the instance to send the traffic to a group of monitoring services interfaces. Finally, use a monitoring group to send flow records from the monitoring services interfaces to a flow server.

Note: When you load-balance port-mirrored traffic across several Monitoring Services interfaces, there are some limitations:

The original Monitoring Services PIC supports this method. You cannot use a Monitoring Services II PIC.
You must use the suite of show passive-monitoring commands to monitor traffic. The show services accounting commands are not supported.
Because load-balanced traffic is routed through the Tunnel Services PIC, the total throughput of the load-balanced traffic coming from the Monitoring Services PICs cannot exceed the bandwidth of the tunnel interface.

For detailed information on this method, see Copying and Redirecting Traffic with Port Mirroring and Filter-Based Forwarding.

[Contents] [Prev] [Next] [Index] [Report an Error]